Get Started: Mobile Device Trust

Overview

JumpCloud Mobile Device Trust brings JumpCloud Go™ to mobile devices and enables seamless, secure access to JumpCloud-protected resources on the go. Using the JumpCloud Protect® mobile app, users register their device with JumpCloud Go, enabling biometric, passwordless verification when accessing protected resources.

When you create Conditional Access Policies in combination with JumpCloud Go for Mobile, you enforce Device Trust. This protects your company’s resources by ensuring users can access them only on trusted devices. Using a combination of JumpCloud Device Management, JumpCloud Go, JumpCloud Protect, and Conditional Access Policies (CAPs), you can safeguard access to both the JumpCloud User Portal and individual SSO apps.

Mobile devices can be trusted when they are enrolled in JumpCloud Device Management, have the JumpCloud Protect app deployed using Software Management, and are registered with JumpCloud Go. After registration, users verify their identity using JumpCloud Go for Mobile and biometrics on their device.

Note:

You can take advantage of JumpCloud Go for Mobile without enforcing device trust. By configuring the necessary prerequisites without creating CAPs, users can register their devices with JumpCloud Protect and use JumpCloud Go for seamless access to the User Portal and SSO apps.
When you enforce CAPs, users on devices that don’t meet the minimum criteria will not be able to access the protected resources.

Important:

See Understand Device Trust Readiness to learn how to configure your org as an admin to use Mobile Device Trust.
See Users: Configure Mobile Device Trust on Apple and Android Devices to learn how users can prepare their mobile devices and access resources.

Prerequisites

To use JumpCloud Go for Mobile:
- JumpCloud Go is enabled for your org. See Get Started: JumpCloud Go to learn more.
- Device Management is enabled for your org:
  - For Apple devices, see Set up Apple MDM to learn more.
  - For Android devices, see Set Up Android EMM to learn more.
- Mobile devices are enrolled in JumpCloud Device Management:
  - Apple devices are enrolled in Apple MDM with the following supported enrollment types:
    - Automated Device Enrollment (ADE).
    - Profile-driven Device Enrollment.
    - Profile-driven User Enrollment.
  - Android devices are enrolled in Android EMM with the following supported enrollment types:
    - Work Profile (Personal device).
    - Work Profile (Company-owned device).
    - Fully managed device.
    - Dedicated device.
- Users are bound to their devices in JumpCloud, otherwise the JumpCloud Go for Mobile registration process will fail.
  - Company-owned devices using Android Zero Touch, Apple Automated Device Enrollment (ADE), or Admin Portal enrollments require you to bind the user to the mobile device record in JumpCloud. See Bind Users to Devices to learn more.
  - BYOD devices using User Enrollment for iOS or Work Profile for Android automatically bind the user to the device during enrollment if initiated via the User Portal.
    - BYOD/User Enrolled Apple devices require Managed Apple IDs (MAIDs) to enroll in MDM.
- Apple VPP and/or Software Management for Android are enabled for your org to deploy the managed JumpCloud Protect app (v2.2.2+) to user devices:
  - For Apple devices, see Manage Software with Apple’s VPP to learn more.
  - For Android devices, Software Management is enabled automatically after configuring Android EMM. See Software Management: Android to learn more.

Note:

Devices without the JumpCloud Protect app will not be able to use JumpCloud Go for Mobile or access resources protected by Device Trust.

To enforce Device Trust:
- Conditional Access Policies (CAPs) are configured for each resource that you want to protect using the Device Management condition.
  - Optionally, use Operating System conditions for granular control of device types. See Configure a Conditional Access Policy to learn more.

Considerations

On mobile devices (iOS/Android), Device Trust is established using JumpCloud Go via the JumpCloud Protect app.
On desktop devices (macOS, Windows, Linux) Device Trust can be established using either JumpCloud Go or Device Trust Certificates for Desktop. See Manage Device Trust Certificates for Desktop to learn more.
- CAPs using the Device Management condition are evaluated based on the platform of the device requesting access.

Limitations

On Android devices using Work Profile, Mobile Device Trust relies on Chrome Custom Tab to launch JumpCloud Go. Apps developed using older Android WebView aren't compatible, for example Google Workspace apps and Salesforce. See Android’s Set up single sign-on with Chrome Custom Tabs to learn more about SSO and Chrome Custom Tabs.
- Workarounds for affected SSO apps:
  - Consider targeting Android devices using the Operating System condition and limit enforcement of the Device Management condition in the CAP configuration.
  - Or utilize the web app in the device browser instead of the standalone/native Android app.

Important:

If you wish to participate in an Early Access (EA) version of Android Mobile Device Trust that is addressing these limitations, please reach out to [email protected].

Enforcing Device Trust

When you configure CAPs to enforce Mobile Device Trust, users can’t access protected resources on untrusted devices. When users first access a protected resource on a trusted device, they’re redirected to the JumpCloud Protect app to register their device with JumpCloud Go. After entering their credentials (and MFA challenge if enabled by the admin), their device is registered with JumpCloud Go, establishing their device as trusted.

When users access protected resources, they verify their identity using JumpCloud Go via the JumpCloud Protect app with device biometrics, granting access. The hardware-backed JumpCloud Go token is valid for 1 year.

For a mobile device to be considered trusted:

The device is enrolled in Device Management: Apple MDM and/or Android EMM.
JumpCloud Protect is deployed to the device using Apple VPP and/or Software Management.
The device passes integrity and jailbreak detection checks.

Accessing the JumpCloud User Portal

If your users access their company resources from the JumpCloud User Portal, you can create a CAP that restricts access on unmanaged devices. Because users require access to the User Portal to register their devices with JumpCloud Go, rather than explicitly block access, the highest level of MFA is used for authentication.

Protecting Individual SSO Apps

You can create CAPs for specific SSO apps available to your users. For example, Slack may contain privileged information that you want users to only access from trusted devices. To do so, create a CAP for the Slack SSO app and restrict access on untrusted devices using the Managed Device condition.

Admin Configuration Workflow

After enabling the prerequisite features, configure your mobile devices to start using JumpCloud Go for Mobile and Device Trust:

Enroll your devices in Device Management. Depending on the device and configuration type, devices can be company enrolled or personally enrolled.
- For company enrolled devices:
  - Apple: See Add Company-Owned Apple Devices to MDM with Device Enrollment to learn more.
  - Android: See Add and Manage Android Devices to learn more.
- For personal devices, user can enroll their device via the User Portal:
  - Apple: See Add Personal Apple Devices to MDM with User Enrollment to learn more.
    - Note: Managed Apple IDs (MAIDs) are required to enroll personal devices in MDM. To perform this action in bulk, see Run the MAID Import Script.
  - Android: See Add and Manage Android Devices to learn more.
Deploy the JumpCloud Protect app (v2.2.2+ƒ) to devices using Apple VPP and/or Android Software Management. See Get Started: Software Management.
- Apple: See Manage Software with Apple’s VPP to learn more.
- Android: See Software Management: Android to learn more.

Important:

Additional configuration is required to use the JumpCloud Protect Android app. See JumpCloud Protect Android App.

Create CAPs in JumpCloud that limit access to the User Portal, SSO apps, or both using the Managed Device condition. Optionally, use the Operating System condition to target specific device types. See Configure a Conditional Access Policy to learn more.

FAQ

Can I use JumpCloud Go for Mobile without configuring access policies?

Yes, if you don’t enforce CAPs. You can use JumpCloud Go to enable secure and seamless authentication on mobile devices.

What is the difference between a managed and trusted device?

Managed device: A device that is enrolled in Device Management (MDM for Apple devices or Google EMM for Android devices). Device management is only one requirement to establish a device as trusted.
Trusted device: A device that meets all of the requirements to be trusted by JumpCloud. This includes enrollment in Device Management as well as JumpCloud Protect and JumpCloud Go registration.

Do I need to be enrolled into JumpCloud Device Management to get Mobile Device Trust? If so, why?

Yes, your mobile device needs to be under management in JumpCloud. NOTE: this is applicable to company-owned and BYO devices.
The current release of Mobile Device Trust uses a number of technologies that are only available via the MDM/EMM protocols.

What if I have contractors that already have management on their devices or are unwilling to enroll in JumpCloud management?

Currently, devices must be JumpCloud managed to get access to Mobile Device Trust functionality. See the previous FAQ for more information.

My employees are concerned about the privacy associated with enrolling into JumpCloud. What can I do to assure them that it’s safe?

End user privacy is a critical pillar for JumpCloud, Apple, and Google. Apple and Google have built enrollment types that specifically cater to employee owned devices to ensure data separation and privacy. JumpCloud built its BYOD offering on top of Apple’s and Google’s MDM/EMM protocols so we are not able to enforce or collect more data than what is enabled by the OEMs.
For details on Apple’s iOS/iPadOS User Enrollment, see User Enrollment and MDM - Apple Support to learn more.
For details on Google’s Android Work Profile, see What policies is my organization enforcing on my device? - Android Enterprise Help to learn more.
Things that JumpCloud can never see on your enrolled BYO mobile device:
- Calling history
- Web browsing history
- Personal emails
- Personal text messages
- Personal contacts
- Personal calendar
- Personal passwords
- Pictures, including what's in the photos app or camera roll
- Content of user created documents

I have employees that are already accessing company SSO endpoints on their unmanaged personal devices. How do I prevent this or remove their access?

Once you’ve rolled out Mobile Device Trust and enable CAPs to block unmanaged instances, you need to consider forcing a password reset on user accounts. This will terminate long-lived mobile sessions and force user re-authentication. When users re-authenticate, the latest CAPs are evaluated and personal/unmanaged access is blocked.

With iOS User Enrollment, I can’t have multiple instances of the same application. What happens if I have a company use case involving a mobile app that my employees also use for personal use?

Apple’s User Enrollment is currently limited to a single app. If you want complete control of the app (for it to be marked as a Managed Application for example), you need to ask users to delete the personally redeemed application and allow for JumpCloud MDM to push the managed version.

What are the minimum OS requirements?

Android 5.0+
iOS/iPadOS 14+

Does Mobile Device Trust work on iPadOS?

Yes. You will need to install the iOS Protect application and the in-app experience will be a scaled version of the iOS experience but all the functionality required for Mobile Device Trust will exist.

Do I need a Managed Apple ID (MAID)? If so, why?

A Managed Apple ID (MAID) is required to enroll a personal iOS device in JumpCloud MDM. The option to do User Enrollment in the User Portal will not appear if the user account has an empty Managed Apple ID field in the JumpCloud Admin Console.
See the following references to learn more:
- Run the MAID Import Script

Is there a Google equivalent of Managed Apple IDs and do I need it?

Currently, all Android EMM enrollments are completed with Managed Google Play accounts that are created at time of enrollment. So at this time, you only need to configure Android EMM.
Google does intend to consolidate the user sign-in experience during device enrollment. End users will in the future use a single managed Google account to log into Android, ChromeOS, and other Google services.

Can I use JumpCloud Protect for existing MFA factors (Mobile Push, TOTP) in addition to JumpCloud Go for Mobile (Mobile Device Trust)?

Yes. The registration process for Mobile Device Trust can co-exist with other MFAs in JumpCloud Protect or other authenticator applications.

Does Mobile Device Trust behave differently based on my enrollment type (Company-owned vs BYOD)?

The general experience after the device is enrolled and has JumpCloud Protect will be consistent within the OS. Additionally, the user experience between Android and iOS Protect has been aligned for relative parity.